@bongos/core 1.21.64 → 1.21.66

package/modules/memory/search.js

@@ -84,7 +84,7 @@ function clampLimit(limit) {
 //   builderRank — the caller's LIVE rank (min_rank scoping).
 // Optional: limit (clamped 1..50), sourceKind ('doc' | 'db' | null = both).
 async function searchChunks(
-  { q, limit = DEFAULT_LIMIT, sourceKind = null, builderId, builderRank } = {},
+  { q, limit = DEFAULT_LIMIT, sourceKind = null, builderId, builderRank, sourceRefPatterns = null } = {},
   { pool: p = pool, client = null } = {}
 ) {
   const query = typeof q === 'string' ? q.trim() : '';
@@ -93,9 +93,13 @@ async function searchChunks(
   const allowedRanks = ranksAtOrBelow(builderRank);
   const ownerId = Number.isInteger(builderId) ? builderId : (Number(builderId) || null);
   const kind = sourceKind === 'doc' || sourceKind === 'db' ? sourceKind : null;
+  // An optional source_ref allowlist (LIKE patterns from refPatterns), applied in
+  // the same scoped CTE as the rank/owner predicate. Null = no narrowing (the
+  // route never passes it); searchPublicDocs always does.
+  const refs = Array.isArray(sourceRefPatterns) ? sourceRefPatterns : null;
 
   // $1 q · $2 allowedRanks[] · $3 ownerId · $4 sourceKind|null · $5 legCandidates · $6 finalLimit
-  // · $7 RRF_K · $8 usefulnessWeight · $9 usefulnessScale (ADR 0095 C3)
+  // · $7 RRF_K · $8 usefulnessWeight · $9 usefulnessScale (ADR 0095 C3) · $10 refPatterns[]|null
   // The scope predicate is shared by both legs (built once as a SQL fragment).
   // websearch_to_tsquery tolerates arbitrary user input (no tsquery syntax to
   // escape); the `<%` operator uses pg_trgm.word_similarity_threshold.
@@ -106,6 +110,7 @@ async function searchChunks(
        WHERE min_rank = ANY($2::text[])
          AND (owner_builder_id IS NULL OR owner_builder_id = $3::bigint)
          AND ($4::text IS NULL OR source_kind = $4::text)
+         AND ($10::text[] IS NULL OR source_ref LIKE ANY($10::text[]))
     ),
     fts AS (
       SELECT id,
@@ -150,7 +155,7 @@ async function searchChunks(
      ORDER BY score DESC, c.id
      LIMIT $6;
   `;
-  const params = [query, allowedRanks, ownerId, kind, LEG_CANDIDATES, lim, RRF_K, USEFULNESS_WEIGHT, USEFULNESS_SCALE];
+  const params = [query, allowedRanks, ownerId, kind, LEG_CANDIDATES, lim, RRF_K, USEFULNESS_WEIGHT, USEFULNESS_SCALE, refs];
   let rows;
   if (client) {
     // Test seam (#950 isolation suite): the caller owns the transaction AND the
@@ -204,6 +209,64 @@ async function searchChunks(
   });
 }
 
+// refPatterns — a docs allowlist as SQL LIKE patterns. An entry ending in '/' is
+// a folder (prefix match); any other entry is one exact file. LIKE's own
+// wildcards are escaped so a path with '_' or '%' in it matches only itself.
+// Anything that is not a plain repo-relative path (absolute, '..', a backslash,
+// empty) is dropped, so a malformed entry narrows the corpus, never widens it.
+function refPatterns(refs) {
+  if (!Array.isArray(refs)) return [];
+  const out = [];
+  for (const raw of refs) {
+    const ref = typeof raw === 'string' ? raw.trim() : '';
+    if (!ref || ref.startsWith('/') || ref.includes('\\') || ref.split('/').includes('..')) continue;
+    const escaped = ref.replace(/[%_]/g, (c) => `\\${c}`);
+    out.push(ref.endsWith('/') ? `${escaped}%` : escaped);
+  }
+  return out;
+}
+
+// searchPublicDocs — recall for someone with NO session: the Discord #support
+// answerer (task 1002534, ADR 0367), served through the `memory.searchPublicDocs`
+// port. Its scope is FIXED HERE and never taken from the caller:
+//   source_kind = 'doc'   (no DB prose: task bodies, learnings, session rows)
+//   min_rank    = 'xenos' (no rank-gated doc: ADR 0043's protected set is metic)
+//   owner       = none    (no builder's private chunk)
+//   source_ref  ∈ refs    (the caller's allowlist of public docs; REQUIRED)
+// xenos is still a signed-in rank, which is why the allowlist is required: an
+// empty or missing list returns [] rather than everything a xenos may read.
+// Returns up to `limit` hits with the chunk body (capped at maxChars), and the
+// body read re-applies the whole scope, so it can't widen what search found.
+async function searchPublicDocs(
+  { q, refs, limit = 5, maxChars = 1500 } = {},
+  { pool: p = pool, client = null } = {}
+) {
+  const patterns = refPatterns(refs);
+  if (!patterns.length) return [];
+  const hits = await searchChunks(
+    { q, limit: Math.min(clampLimit(limit), 10), sourceKind: 'doc', builderId: null, builderRank: 'xenos', sourceRefPatterns: patterns },
+    { pool: p, client }
+  );
+  if (!hits.length) return [];
+  const cap = Math.max(200, Math.min(Number(maxChars) || 1500, 4000));
+  const sql = `
+    SELECT id, source_ref, heading_path, title, left(body, $2::int) AS body
+      FROM search_chunks
+     WHERE id = ANY($1::bigint[])
+       AND source_kind = 'doc'
+       AND min_rank = 'xenos'
+       AND owner_builder_id IS NULL
+       AND source_ref LIKE ANY($3::text[])`;
+  const params = [hits.map((h) => h.id), cap, patterns];
+  const { rows } = client ? await client.query(sql, params) : await p.query(sql, params);
+  const byId = new Map(rows.map((r) => [Number(r.id), r]));
+  // Keep the search's ranking order.
+  return hits.filter((h) => byId.has(h.id)).map((h) => {
+    const r = byId.get(h.id);
+    return { id: h.id, source_ref: r.source_ref, heading_path: r.heading_path, title: r.title, body: r.body || '', score: h.score };
+  });
+}
+
 // fetchChunkBody — the EXPAND half of progressive disclosure (ADR 0095 C1 / task
 // 1658). Given a chunk id, return its FULL body — but scoped exactly like
 // searchChunks (same min_rank + owner predicate built from the authenticated
@@ -505,6 +568,8 @@ function classifyEmptyResult(health) {
 
 module.exports = {
   searchChunks,
+  searchPublicDocs,
+  refPatterns,
   // task 1003097: a zero-result search must say WHICH of three things happened —
   // a dead index, a scoping wall, or a genuine miss.
   corpusHealth,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.64",
+  "version": "1.21.66",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.64",
+      "version": "1.21.66",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.64",
+  "version": "1.21.66",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9160,5 +9160,17 @@
       "id": "1002304",
       "text": "Owners now see people who applied with a guild grouped under that guild's name in the applications queue, with one \"Invite all\" button that still admits each person individually."
     }
+  ],
+  "1.21.65": [
+    {
+      "id": "1002534",
+      "text": "The Discord bot can now answer questions in #support when someone @-mentions it, using only the project's public newcomer docs. It ships switched off: it starts answering once the owner adds an Anthropic key and turns it on, a"
+    }
+  ],
+  "1.21.66": [
+    {
+      "id": "1003451",
+      "text": "The builder profile page no longer downloads a script that could never run; nothing on the page changes for anyone."
+    }
   ]
 }

package/scripts/gds/credential-presence.js

@@ -96,6 +96,11 @@ const CREDENTIALS = [
     names: ['DISCORD_BOT_TOKEN'],
     purpose: 'the Discord bot (modules/discord); also readable from discord-bot.json in the config dir',
   },
+  {
+    id: 'discord-support', file: 'web.env', need: 'optional',
+    names: ['DISCORD_SUPPORT_ANTHROPIC_API_KEY'],
+    purpose: 'the #support answerer (modules/discord/discord-support.js, ADR 0367); its own key, never a host-wide ANTHROPIC_API_KEY',
+  },
   {
     id: 'discord-oauth', file: 'web.env', need: 'optional',
     names: ['DISCORD_CLIENT_ID', 'DISCORD_CLIENT_SECRET'],

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.64'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.66'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/canonical_profile_url.mjs

@@ -9,14 +9,15 @@
 // OWN WHERE CLAUSE and throws on a placeholder or a literal comparison it did
 // not consume, so a predicate this file cannot read can never degrade into "no
 // constraint" and quietly pass. The REAL core router runs above it over a REAL
-// loopback socket, and the REAL browser script runs in a vm above a stub DOM.
-// Nothing here asserts against a canned response.
+// loopback socket. Nothing here asserts against a canned response.
 //
-// THE FLAG IS FALSE TODAY (ADR 0214 D1), so the three render behaviours are all
-// no-ops in production. Testing only that would be testing nothing, so the
-// client tests run the SAME source with the one constant flipped — and assert
-// the substitution changed exactly one thing, because a mutation that misses is
-// the failure mode this file exists to avoid.
+// THE FLAG IS FALSE (ADR 0214 D1), and the page that would flip it (goal
+// 1000048 R14, task 1002365) was abandoned. So the browser half that would have
+// rendered rel=canonical, the link-out and the numeric-id redirect was removed
+// (task 1003451): it shipped 137 lines of permanently dead branches to every
+// /profile reader. The server half stays — getPublicHandle is live, and the
+// resolver is what a rebuilt page will call. The test below pins the absence,
+// and fails the moment the flag flips without the browser half coming back.
 //
 // LANE: DB-free. It must run on every PR, where there is no Postgres. The last
 // test asserts that membership from the runner's own source (learning 1000218 —
@@ -26,7 +27,6 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import http from 'node:http';
-import vm from 'node:vm';
 import express from 'express';
 import { createRequire } from 'node:module';
 import { readFileSync } from 'node:fs';
@@ -48,7 +48,6 @@ const require = createRequire(import.meta.url);
 const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
 const read = (...p) => readFileSync(join(ROOT, ...p), 'utf8');
 
-const CLIENT_SRC = read('modules', 'hall-ui', 'public', 'profile-canonical.js');
 const MODULE_SRC = read('modules', 'platform-identity', 'canonical-profile.js');
 const PROFILE_JS = read('modules', 'hall-ui', 'public', 'profile.js');
 const PROFILE_HTML = read('modules', 'hall-ui', 'public', 'profile.html');
@@ -429,154 +428,21 @@ test('an older hub provider without getPublicHandle degrades to null instead of
 test.after(() => server.close());
 
 // ===========================================================================
-// The browser script — the three behaviours, run for real in a vm
+// The wiring: the page and the stamp
 // ===========================================================================
 
-const LIVE_SRC = CLIENT_SRC.replace('const CANONICAL_PROFILE_PAGE_LIVE = false;', 'const CANONICAL_PROFILE_PAGE_LIVE = true;');
-
-test('the live-source substitution changes exactly one thing (the instrument, checked first)', () => {
-  assert.notEqual(LIVE_SRC, CLIENT_SRC, 'the constant this file flips is not spelled the way the test expects — every client assertion below would be testing the dark path');
-  const diffs = CLIENT_SRC.split('\n').filter((l, i) => l !== LIVE_SRC.split('\n')[i]);
-  assert.equal(diffs.length, 1, 'the substitution must flip one line, not rewrite the module');
-});
-
-function boot(src, { hubOriginMeta, modules, search } = {}) {
-  const head = { children: [], appendChild(el) { this.children.push(el); } };
-  const els = new Map();
-  const el = (id) => {
-    if (!els.has(id)) els.set(id, { id, hidden: true, _html: '', attrs: {}, setAttribute(k, v) { this.attrs[k] = v; }, getAttribute(k) { return this.attrs[k] ?? null; }, set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } });
-    return els.get(id);
-  };
-  const meta = hubOriginMeta === undefined ? null : { getAttribute: () => hubOriginMeta };
-  const replaced = [];
-  const assigned = [];
-  const sandbox = {
-    console: { error() {}, warn() {}, log() {} },
-    URL,
-    URLSearchParams,
-    document: {
-      head,
-      querySelector: (sel) => (sel === 'meta[name="hub-origin"]' ? meta : (head.children.find((c) => c.attrs.rel === 'canonical') || null)),
-      getElementById: (id) => (id === 'xp-scroll' || id === 'xp-body' ? el(id) : null),
-      createElement: () => ({ attrs: {}, setAttribute(k, v) { this.attrs[k] = v; }, getAttribute(k) { return this.attrs[k] ?? null; } }),
-    },
-    // `assign` is stubbed too, and deliberately records into a SEPARATE list:
-    // swapping replace→assign must fail on the assertion (the numeric URL would
-    // stay in history as a place Back returns to), not crash on an undefined
-    // method, which would "pass" the mutation check for the wrong reason.
-    location: { search: search || '', replace: (u) => replaced.push(u), assign: (u) => assigned.push(u), href: '' },
-    window: { OTB: { escapeHtml: (s) => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;') }, __MODULES__: modules || [] },
-  };
-  sandbox.globalThis = sandbox;
-  vm.createContext(sandbox);
-  vm.runInContext(src, sandbox, { filename: 'profile-canonical.js' });
-  return {
-    api: sandbox.window.OTBCanonical,
-    canonicalHref: () => { const l = head.children.find((c) => c.attrs.rel === 'canonical'); return l ? l.attrs.href : null; },
-    xp: () => el('xp-scroll'),
-    xpHtml: () => el('xp-body').innerHTML,
-    replaced,
-    assigned,
-  };
-}
-
-const FEDERATED = { hubOriginMeta: 'https://cloudbongos.com', modules: ['lifecycle', 'hall-ui'] };
-const HUB = { hubOriginMeta: 'https://cloudbongos.com', modules: ['platform-identity', 'hall-ui'] };
-
-test('DARK today: with the shipped source nothing is emitted, anywhere', () => {
-  const fed = boot(CLIENT_SRC, FEDERATED);
-  fed.api.render({ handle: 'ada' });
-  assert.equal(fed.canonicalHref(), null, 'a canonical must not name a URL that 404s');
-  assert.equal(fed.xp().hidden, true);
-  const hub = boot(CLIENT_SRC, { ...HUB, search: '?id=7' });
-  hub.api.render({ handle: 'ada' });
-  assert.deepEqual(hub.replaced, [], 'redirecting a working page to a 404 would be the worst of the three');
-});
-
-test('LIVE, federated: rel=canonical points at the hub and the link-out is visible', () => {
-  const page = boot(LIVE_SRC, FEDERATED);
-  page.api.render({ handle: 'ada' });
-  assert.equal(page.canonicalHref(), 'https://cloudbongos.com/u/ada');
-  assert.equal(page.xp().hidden, false);
-  assert.match(page.xpHtml(), /href="https:\/\/cloudbongos\.com\/u\/ada"/);
-  assert.match(page.xpHtml(), /See the cross-project record/,
-    'the link-out is what ADR 0171 D1 asks a federated instance to render instead of inlining numbers');
-  assert.deepEqual(page.replaced, [], 'a federated instance shows its OWN record — it must never redirect away from it');
-});
-
-test('LIVE, hub: the numeric ?id= form redirects to the canonical handle URL', () => {
-  const page = boot(LIVE_SRC, { ...HUB, search: '?id=7' });
-  page.api.render({ handle: 'ada' });
-  assert.deepEqual(page.replaced, ['https://cloudbongos.com/u/ada']);
-  assert.equal(page.canonicalHref(), null, 'a page that redirects must not also declare a canonical');
-});
-
-test('LIVE, hub without ?id=: the self view is not redirected', () => {
-  const page = boot(LIVE_SRC, { ...HUB, search: '' });
-  page.api.render({ handle: 'ada' });
-  assert.deepEqual(page.replaced, [], 'the handle-less /profile is the viewer\'s own page, not a numeric address');
-});
-
-test('LIVE: no handle means no canonical, no link-out and NO REDIRECT — the fallback is a working page', () => {
-  for (const data of [{}, { handle: null }, { handle: '' }]) {
-    const fed = boot(LIVE_SRC, FEDERATED);
-    fed.api.render(data);
-    assert.equal(fed.canonicalHref(), null);
-    assert.equal(fed.xp().hidden, true);
-
-    const hub = boot(LIVE_SRC, { ...HUB, search: '?id=7' });
-    hub.api.render(data);
-    assert.deepEqual(hub.replaced, [],
-      'absent, provisional and private all arrive here as a missing handle and all get the ordinary local page — there is no error shape to read a signal off');
-  }
-});
-
-test('LIVE: a vanilla instance with no hub origin emits nothing', () => {
-  for (const meta of [undefined, '', '   ', 'http://cloudbongos.com', 'https://cloudbongos.com/u']) {
-    const page = boot(LIVE_SRC, { hubOriginMeta: meta, modules: [] });
-    page.api.render({ handle: 'ada' });
-    assert.equal(page.canonicalHref(), null, `an unusable hub-origin meta (${JSON.stringify(meta)}) must produce no canonical, never a relative one`);
-    assert.equal(page.xp().hidden, true);
-  }
-});
-
-test('LIVE: a hostile handle from the wire never reaches an href', () => {
-  for (const handle of ['ada/../../admin', 'ada"onload=x', '../evil', 'a b']) {
-    const page = boot(LIVE_SRC, FEDERATED);
-    page.api.render({ handle });
-    assert.equal(page.canonicalHref(), null, `handle ${JSON.stringify(handle)} must be refused, not encoded`);
-  }
-});
-
-// ===========================================================================
-// The wiring: the mirror, the page, and the stamp
-// ===========================================================================
-
-test('the client mirror and the module agree on both constants', () => {
-  const liveInModule = /const CANONICAL_PROFILE_PAGE_LIVE = (true|false);/.exec(MODULE_SRC);
-  const liveInClient = /const CANONICAL_PROFILE_PAGE_LIVE = (true|false);/.exec(CLIENT_SRC);
-  assert.ok(liveInModule && liveInClient, 'both files must spell the flag as a plain const so this guard can read it');
-  assert.equal(liveInClient[1], liveInModule[1],
-    'the browser mirror has drifted from modules/platform-identity/canonical-profile.js — flip both or neither');
-  assert.equal(String(CANONICAL_PROFILE_PAGE_LIVE), liveInModule[1], 'the module export disagrees with its own source');
-
-  const prefixInClient = /const CANONICAL_PROFILE_PREFIX = '([^']+)';/.exec(CLIENT_SRC);
-  assert.ok(prefixInClient, 'the client must spell the prefix as a plain const');
-  assert.equal(prefixInClient[1], CANONICAL_PROFILE_PREFIX, 'the two canonical namespaces have drifted apart');
-});
-
-test('the profile page loads the script BEFORE profile.js, and profile.js calls it', () => {
-  // Match the <script> TAGS, not the filenames: both names also appear in the
-  // page's prose, and an ordering assertion that reads a comment proves nothing.
+test('while the page is dark, /profile ships no canonical wiring at all (task 1003451)', () => {
+  // The browser half (profile-canonical.js) was removed when R14 — the
+  // /u/<handle> page that would have turned it on — was abandoned: 137 lines
+  // whose every branch sat behind a false flag, shipped to every /profile
+  // reader. Rebuild it with the page. Until then the module's flag is the one
+  // statement of "dark", and nothing in the hall may branch on it.
+  assert.equal(CANONICAL_PROFILE_PAGE_LIVE, false,
+    'the flag flipped: the /u/<handle> page now resolves, so the browser half (rel=canonical, link-out, numeric-id redirect) has to be rebuilt in this same change');
   const tags = [...PROFILE_HTML.matchAll(/<script\s+src="\/builders\/([a-z-]+\.js)/g)].map((m) => m[1]);
-  assert.ok(tags.includes('profile-canonical.js'),
-    'the page never loads the script, so nothing above runs in a browser');
-  assert.ok(
-    tags.indexOf('profile-canonical.js') < tags.indexOf('profile.js'),
-    `profile.js must load AFTER profile-canonical.js so window.OTBCanonical exists when renderProfile runs — got ${tags.join(', ')}`,
-  );
-  assert.match(PROFILE_JS, /window\.OTBCanonical\.render\(data\)/,
-    'profile.js must hand the profile response to the canonical wiring');
+  assert.ok(tags.includes('profile.js'), 'the tag reader matched nothing, so the next assertion would pass vacuously');
+  assert.ok(!tags.includes('profile-canonical.js'), 'the page loads a canonical script whose every branch is dead');
+  assert.doesNotMatch(PROFILE_JS, /OTBCanonical/, 'profile.js branches on a canonical wiring that does not exist');
 });
 
 test('the hub origin is stamped as a meta, and never straight into an href', () => {
@@ -593,9 +459,9 @@ test('the hub origin is stamped as a meta, and never straight into an href', ()
 });
 
 test('the resolver is the ONLY place that spells the canonical namespace', () => {
-  // Two files may carry it: the module and its browser mirror (checked equal
-  // above). A third would be a second opinion about where a profile lives.
-  const owners = ['modules/platform-identity/canonical-profile.js', 'modules/hall-ui/public/profile-canonical.js'];
+  // One file carries it: the module. A second would be a second opinion
+  // about where a profile lives.
+  const owners = ['modules/platform-identity/canonical-profile.js'];
   const offenders = [];
   const walk = (rel) => {
     for (const e of require('node:fs').readdirSync(join(ROOT, rel), { withFileTypes: true })) {